我正在使用curl和pycurl连接到安全的第三方api,当我使用pycurl时,我从服务器返回验证错误,但是当我在命令行上使用curl并执行相同的操作时。我将两者都设置为详细模式,并且在请求中看到了一些差异,但我似乎无法弄清楚错误是什么。
他们似乎使用不同的加密方法,也许这就是问题所在?如果有人有关于尝试pycurl的不同选项的想法或重新编译pycurl工作像curl的建议,那将是非常棒的。感谢。
以下是我的pycurl设置,fyi:
buffer = cStringIO.StringIO()
curl = pycurl.Curl()
curl.setopt(pycurl.VERBOSE,1)
curl.setopt(pycurl.POST, 1)
curl.setopt(pycurl.POSTFIELDS, post_data)
curl.setopt(pycurl.TIMEOUT_MS, self.HTTP_TIMEOUT)
curl.setopt(pycurl.URL, url)
curl.setopt(pycurl.FOLLOWLOCATION, self.HTTP_FOLLOW_REDIRECTS)
curl.setopt(pycurl.MAXREDIRS, self.HTTP_MAX_REDIRECTS)
curl.setopt(pycurl.WRITEFUNCTION, buffer.write)
curl.setopt(pycurl.NOSIGNAL, 1)
curl.setopt(pycurl.SSLCERT, self.path_to_ssl_cert)
curl.setopt(pycurl.SSL_VERIFYPEER, 0)
# 1/0
try:
curl.perform()
...
哦,最后一件事:我正在使用的相同python脚本在我的Mac笔记本电脑上工作,但在我试图设置的ubuntu服务器上不起作用。
python test.py
18:09:13,299 root INFO fetching: https://secure.....
* About to connect() to secure.... 1129 (#0)
* Trying 216....... * connected
* Connected to secure.... port 1129 (#0)
* found 102 certificates in /etc/ssl/certs/ca-certificates.crt
* server certificate verification OK
* common name: secure.... (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject: .......
* start date: Sat, 14 Feb 2009 22:45:27 GMT
* expire date: Mon, 15 Feb 2010 22:45:27 GMT
* issuer: ...
* compression: NULL
* cipher: AES 128 CBC
* MAC: SHA
User-Agent: PycURL/7.16.4
Host: secure....
Accept: */*
Content-Length: 387
Content-Type: application/x-www-form-urlencoded
< HTTP/1.1 200 OK
< Content-Length: 291
<
* Connection #0 to host secure.... left intact
* Closing connection #0
curl -v -d '...' --cert cert.pem https://secure....
* About to connect() to secure.... port 1129 (#0)
* Trying 216....... connected
* Connected to secure.... port 1129 (#0)
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
* SSLv2, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Request CERT (13):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS handshake, CERT verify (15):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES256-SHA
* Server certificate:
* subject: .......
* start date: 2009-02-14 22:45:27 GMT
* expire date: 2010-02-15 22:45:27 GMT
* common name: secure.... (matched)
* issuer: ... Certificate Authority
* SSL certificate verify ok.
> User-Agent: curl/7.16.4 (i486-pc-linux-gnu) libcurl/7.16.4 OpenSSL/0.9.8e zlib/1.2.3.3 libidn/1.0
> Host: secure....:1129
> Accept: */*
> Content-Length: 387
> Content-Type: application/x-www-form-urlencoded
>
< HTTP/1.1 200 OK
< Content-Length: 342
答案 0 :(得分:3)
Ubuntu pycurl使用GnuTLS而ubuntu curl命令行使用OpenSSL。 存在差异,例如支持的证书格式。
我无法理解ubuntu devs / packagers做出的这个决定。我偶然发现了这一次并无法解决它,幸运的是还有其他发行版而不是ubuntu: - )
你总是可以试图抱怨“对他人的人性。”
答案 1 :(得分:1)
我在理解您发布的代码/输出片段时遇到了一些麻烦。是否包含实际错误消息?
SSL / TLS的问题通常是因为X.509证书基础结构。有“证书颁发机构”(CA),如Verisign,RapidSSL等,它们以数字方式“签署”服务器证书。要检查这些签名,您需要CA的所谓“根证书”,签署您要连接的服务器(“颁发者”)的证书。
通常,操作系统会预先安装相当数量的证书。通常,浏览器,操作系统和某些库都有自己的证书列表。在Mac上你可以看到它们,如果你启动程序“Keychain Access”并打开“System Roots”钥匙串。
因此,我建议您检查Ubuntu是否缺少证书,如果是,则将其添加到那里。 (也许这都保存在/ etc / ssl / certs /中)